Allow Dualstack Networking (ENABLE_IPv6 AND ENABLE_IPv4)#3616
Open
DonavanFritz wants to merge 1 commit intoaws:masterfrom
Open
Allow Dualstack Networking (ENABLE_IPv6 AND ENABLE_IPv4)#3616DonavanFritz wants to merge 1 commit intoaws:masterfrom
DonavanFritz wants to merge 1 commit intoaws:masterfrom
Conversation
Allow ENABLE_IPv4=true and ENABLE_IPv6=true simultaneously for IPAMD pods. Both address families on the same ENI (primary first, secondary for overflow). No branch ENI changes, no NAT/SNAT. Changes: - ipamd.go: enableDualStack derived field, isConfigValid() lifts mutual exclusivity, setupENI() uses IPv4 primary in dual-stack and adds trunk ENI guard, warm pool runs for dual-stack, configureIPRulesForPods() fixes mask selection and adds IPv6 loop - rpc_handler.go: AddNetwork/DelNetwork dual-stack paths with family-qualified IPAM keys (/v4, /v6), rollback on partial failure - data_store.go: AssignPodIPv6AddressFromENI (same-ENI allocation), AllocatedIPv6s (restart reconciliation) - cni.go: IPAMD add/del paths populate IPv6Address in veth metadata - driver.go: SetupPodNetwork/TeardownPodNetwork handle IPv6, addSecondaryIPToContainer with DAD disable and fe80::1 gateway - network.go: AddIPv6DefaultRouteToENITable for secondary ENI IPv6 routing (separate method to avoid breaking NetworkAPIs interface) - aws-vpc-cni/main.go: disable egress plugin in dual-stack mode (prevents v4if0/v6if0 when both ENABLE_IPv4 and ENABLE_IPv6 are true) Incorporates trunk ENI fix (!isTrunkENI guard in setupENI to prevent panic on trunk ENIs with no primary IP).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
feature
Which issue does this PR fix?:
#3615
What does this PR do / Why do we need it?:
Enables dual-stack pod networking by allowing
ENABLE_IPv4=trueandENABLE_IPv6=truesimultaneously. Both address families are assigned to podeth0from prefix-delegated addresses on the same ENI. No NAT/SNAT, no egress interfaces.Currently the CNI rejects this combination in
isConfigValid(). Pods must choose IPv4-only or IPv6-only, relying on NAT egress (v4if0/v6if0) for the other family. This change removes that restriction whenENABLE_PREFIX_DELEGATION=true.Key behaviors:
/80and IPv4/28prefixes are allocated on the same ENI (primary first, secondary for overflow)eth0— no egress interfaces createdupdateHostIptablesRules()returns nil whenenableIPv6=true)ENABLE_V4_EGRESS/ENABLE_V6_EGRESSvaluesTesting done on this change:
Deployed to a dev EKS cluster (5 nodes, v1.21.0 base).
Sample pod verification:
$ ip addr show eth0
inet 100.89.89.128/32 scope global eth0
inet6 2a03:5640:f13c:1:7a::4/128 scope global
$ ip link show v4if0
Device "v4if0" does not exist.
$ ip link show v6if0
Device "v6if0" does not exist.
IPAMD logs confirm:
"Dual-stack mode: IPv6 + IPv4 prefixes on same ENI (primary first)"Entrypoint logs confirm:
"Dual-stack mode: egress plugin disabled (both IPv4 and IPv6 on eth0)"Will this PR introduce any new dependencies?:
No. No new APIs, IMDS calls, kernel modules, or binary dependencies. Uses existing EC2 prefix delegation APIs already called in single-stack modes.
Will this break upgrades or downgrades? Has updating a running cluster been tested?:
No. Dual-stack only activates when all three flags are explicitly true (
ENABLE_IPv4,ENABLE_IPv6,ENABLE_PREFIX_DELEGATION). Existing single-stack configurations are unchanged. Tested upgrade from single-stack to dual-stack viakubectl set envon a running cluster — pods created after the rollout get dual-stack, existing pods continue working until recycled.Does this change require updates to the CNI daemonset config files to work?:
Yes — set
ENABLE_IPv6=trueon a cluster already running withENABLE_IPv4=trueandENABLE_PREFIX_DELEGATION=true. Works withkubectl set env daemonset/aws-node -n kube-system ENABLE_IPv6=true. No other config changes required.Does this PR introduce any user-facing change?:
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.